PRHunt retries have no cumulative wall-clock budget

[wolfgang-aura]

Impact

PRHunt runs can consume many hours because agent timeouts and review-cycle limits apply per invocation. A coordinator can call resume-review with larger limits, so the same candidate gets more hour-long agent calls. On 2026-09-09, run 20260909T053801Z-e02330 spent about four hours in orchestration, reached five review cycles, and then hit the account usage limit. Another candidate reached nine review cycles and four revisions.

This defeats the bounded-run promise and can exhaust the shared Codex allowance without producing a candidate.

Reproduction

1. Start an orchestration with the default limits.
2. Let the reviewer request changes until the run blocks on its cumulative cycle limit.
3. Call resume-review with a higher --max-review-cycles and --max-revisions value.
4. Repeat. Each invocation gets a fresh per-agent timeout, and no persisted wall-clock deadline stops the run.

Evidence

• Environment: Windows, Mailman 6ad0491.
• 20260909T053801Z-e02330: 38m primary, 34m review, 56m revision, then four more reviewer or revision calls. Five review cycles were recorded before usage exhaustion.
• 20260909T042707Z-8cf031: four revisions and nine review cycles.
• mailman orchestrate defaults each agent call to 3600 seconds and has no cumulative run deadline.

Next action

Persist a cumulative orchestration deadline per run, clamp every agent and verification call to its remaining time, and refuse deadline increases unless the operator supplies a recorded override reason. Add regression coverage across resume-review invocations.

[wolfgang-aura]

A second pre-run waste path was confirmed while resuming hunt 20260909T052906Z-0841be. The repository screen passed langchain-ai/langgraph, but target intel had already found the require-issue-link bot rule. The coordinator still ran primary and reviewer work for issue #8850; the finished patch cannot be filed because the issue is unassigned and an external PR would be auto-closed. Local follow-up now makes screen-target search closed PRs, inspect the actual bot comments, and reject only a verified marker. A live probe rejects LangGraph and avoids false positives from three loose GitHub search matches in openai/openai-agents-python. Tests cover both paths.

[wolfgang-aura]

Local checkpoints are now 28b5efc (cumulative deadline, session reuse, token/tool-output limits, prompt discipline, scope gate) and b58624a (exact assignment-bot preflight). Verification: 756 tests and 54 subtests passed in 215.54s; Ruff passed on the changed Python files; git diff --check passed. Live probes resumed the same Luna session successfully, rejected langchain-ai/langgraph from exact require-issue-link markers on PRs #8862/#8860/#8858/#8856/#8853, and allowed openai/openai-agents-python after verifying its three loose search hits contained no marker. Commits remain local and are not deployed, so this issue stays open.

[wolfgang-aura]

Structural speed work is now on main in b7d13eb.

This changes the workflow rather than relying on the two-hour circuit breaker:

• pre-screen reads the real issue and rejects closed or feature/enhancement/question/project/tracking work before searches or a run;
• pre-screened symbols and the recorded baseline flow into both role prompts;
• the primary does focused implementation checks instead of repeating discovery, reproduction, and the full gate;
• Mailman owns the full verification before review and after approval;
• the reviewer receives changed paths, diff stat, and the primary report, and reviews code instead of duplicating the full gate;
• Codex revisions resume the same role session with only new findings;
• the full coordinator procedure is no longer appended to every agent turn.

Live read-only validation rejected the previously expensive pydantic/pydantic-ai#8232 feature issue in 1.15 seconds and skipped duplicate search, prior art, and claims. No new candidate run was started. Regression result: 762 tests and 54 subtests passed.

The remaining acceptance check is a future real Luna PRHunt run when usage is available; the operator explicitly asked not to start one now.

[wolfgang-aura]

Live failure on hunt 20260909T132008Z-054119 proves the implemented deadline is attached to the wrong unit.

The PRHunt task started at 13:20:08Z and was still running after 15:52Z. Each candidate had a fresh two-hour deadline, so the coordinator could replace candidates forever:

• 20260909T132347Z-ddf1ac: 54m58s from run creation to final block.
• 20260909T142503Z-7ed8c9: 1h16m16s from run creation to final block.
• 20260909T154730Z-e62147: a third run started after the hunt had already crossed two hours.

The third run repeated openai/openai-python#3828, which the second run had just dropped. Luna began again until the operator stopped the process. The hunt is now abandoned and its lease released.

Required fix: persist the cumulative deadline on the hunt, clamp all screening, environment, candidate, agent, verification, and packaging work to the hunt's remaining time, and refuse new candidates after expiry. Candidate deadlines remain useful but cannot define the operator-facing PRHunt budget.

[wolfgang-aura]

The same live hunt also disproves our assumption about the Codex token setting. Run 20260909T132347Z-ddf1ac records token_budget: 2000000, but its first Luna primary reported 9,753,232 cumulative input tokens, 9,515,520 cached input tokens, and 48,313 output tokens over 24m03s. The setting did not cap cumulative context processing at two million tokens.

Treat token_budget.limit_tokens as unverified until its exact semantics are measured. Mailman needs its own observable per-role usage budget or a smaller turn/command protocol rather than claiming this configuration bounds total input consumption.